Last October, cyber thieves breached millions of smart DVRs and webcams to attack the Internet infrastructure provider Dyn, disabling websites like Facebook, Twitter, Netflix and others throughout the U.S. and Europe.
Cyber experts pointed to vulnerabilities associated with the Internet of Things, or IoT, stating that this will continue to be a growing problem in 2017, so long as cyber thieves can easily hijack everyday devices like cameras, washing machines, medical devices, baby monitors, lamps and more.
You may have experienced that temporary inconvenience in October, thinking Facebook and other sites were just down, and not really giving it a second thought. But what if it was your power that went out? Or, your water was suddenly turned off?
What if there was a cyberattack on Palo Verde Nuclear Generating Station, just 50 miles west of Phoenix?
A decade ago, this catastrophic scenario might have seemed unlikely, but my biggest worry is that the bad guys have already penetrated our utility companies and are waiting to launch an attack.
Think about it. The same group of hackers who breached the DNC are believed to be behind the cyberattacks of several U.S. energy companies in 2014. They launched several attacks in 2015 in the Ukraine and are believed to be behind the most recent cyberattack in December of an electric substation that caused a partial power outage in Kiev. The reports I read stated that they were lurking inside the system for nine months before they launched the attack.
It could have been a lot worse, as power was only out for about an hour, but I think they were conducting a test. Or just as bad, showing the world what they are capable of doing. And, we all should be concerned that the Department of Homeland Security reported in late December that Russian malware was found on a Burlington Electric Company laptop in Vermont. Fortunately, the laptop was not connected to the grid control system.
Nationally, our leaders need to invest more aggressively in cybersecurity. The F-35 fleet can’t protect us against these enemies. We need to build up our offense — our adversaries have certainly made it their top priority.
Locally, I implore you to be more aware. Educate yourself, your employees and your family. If you’re like most people, you interact with numerous IoT devices on a daily basis. You may love the fact that you can start your car before leaving the house, or watch your baby or pet while sitting in your office, but how secure is your system? It’s not just your computer and cell phone that need to be protected.
Businesses need to examine IoT risks as well. Hackers could breach the HVAC system in a building, raise the temperature and cause damage to servers. If the doors in your office building are power-controlled, they could shut the breakers in the middle of the night and turn off the power so the doors automatically open to comply with fire codes. The list of breach scenarios is endless.
There are things you can do right now to protect yourself, both at home and at work.
For home, make a list of every device you have that connects to the Internet, whether wired or wireless. Once identified, make sure you have downloaded and installed the latest ‘firmware’ (the software that runs the device) from the manufacturer’s website. Also, make sure you have changed the default password that came with the device. Finally, make sure the devices are behind some type of firewall from a reputable vendor like Linksys or Netgear. Avoid D-Link as the FTC just sued them over their security flaws.
For work, you should have a more advanced firewall such as a Cisco or a SonicWALL that is capable of segregating and protecting multiple networks. Place all of your industrial control systems on separate networks that can’t be reached from the ‘main’ network. Just like at home, make sure the default password for all of these systems has been changed to something long, unique and complex.
Install security updates on each device regularly. Be especially vigilant about your cell phone. Both Apple and Google regularly release updates to their mobile software. Sometimes hardware manufacturers or cellular providers don’t pass those updates along immediately, so it is important to remain prudent about updating.
If you own or manage a business, include devices used by employees working remotely. Remote workers allow potentially sensitive or confidential information to reside on a PC which is outside of a company’s control. Additionally, a company has to open a ‘hole’ in its perimeter defenses in order to allow users in.
There are many other ways you can protect yourself or your business from hackers. The most important thing is to recognize that you are vulnerable and learn what options you have to build up your cyber wall of defense.
I hope you will join me in urging our national and local leaders to invest heavily in cyber defenses that will deter these insidious criminals. The danger of a cyberattack on our critical infrastructure is real, and we all need to do our part to protect our society.
— Michael Cocanower, founder and president of Phoenix-based itSynergy, conducts free 15-minute “Hacking the Human” webinars on the second Thursday of every month at 11:30 a.m. Register at http://www.itsynergy.com/webinar.